orangeCatDeveloper opened a new issue, #4408: URL: https://github.com/apache/hertzbeat/issues/4408
### Description The 1.9.0 distribution still bundles `xercesImpl-2.11.0.jar`, which is affected by [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) (infinite loop / DoS when parsing crafted XML, fixed in 2.12.2). It was also flagged in the 1.6.0 vulnerability scan in #2797. HertzBeat does not declare it directly; it comes in transitively via `easypoi-base` 4.3.0 and `nekohtml` 1.9.22. ### Task List - [ ] Pin `xerces:xercesImpl` to 2.12.2 in the root `pom.xml` `<dependencyManagement>` - [ ] Update `material/licenses` if the bundled version changes - [ ] Verify Excel/YAML monitor import and export still work -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
